{"record":{"id":"c89f30449ec50f58","repo":"apache/hadoop","slug":"unauthorized-connection-for-super-user-from-ip","errorCode":null,"errorMessage":"Unauthorized connection for super-user: {} from IP {}","messagePattern":"Unauthorized connection for super-user: (.+?) from IP (.+?)","errorType":"exception","errorClass":"AuthorizationException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/DefaultImpersonationProvider.java","lineNumber":132,"sourceCode":"    }\n\n    UserGroupInformation realUser = user.getRealUser();\n    if (realUser == null) {\n      return;\n    }\n    \n    AccessControlList acl = proxyUserAcl.get(configPrefix +\n        realUser.getShortUserName());\n    if (acl == null || !acl.isUserAllowed(user)) {\n      throw new AuthorizationException(\"User: \" + realUser.getUserName()\n          + \" is not allowed to impersonate \" + user.getUserName());\n    }\n\n    MachineList MachineList = proxyHosts.get(\n        getProxySuperuserIpConfKey(realUser.getShortUserName()));\n\n    if(MachineList == null || !MachineList.includes(remoteAddress)) {\n      throw new AuthorizationException(\"Unauthorized connection for super-user: \"\n          + realUser.getUserName() + \" from IP \" + remoteAddress);\n    }\n  }\n  \n  private String getAclKey(String key) {\n    int endIndex = key.lastIndexOf(\".\");\n    if (endIndex != -1) {\n      return key.substring(0, endIndex); \n    }\n    return key;\n  }\n  \n  /**\n   * Returns configuration key for effective usergroups allowed for a superuser\n   * \n   * @param userName name of the superuser\n   * @return configuration key for superuser usergroups\n   */","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/DefaultImpersonationProvider.java#L114-L150","documentation":"DefaultImpersonationProvider throws AuthorizationException when the proxy-user ACL check passed but the client IP is not accepted: the MachineList from hadoop.proxyuser.<name>.hosts is null (property missing) or does not include remoteAddress. This is the host-level half of proxyuser authorization, evaluated after the group/user ACL.","triggerScenarios":"proxyUserAcl allowed the user, but proxyHosts.get(\"hadoop.proxyuser.\" + realUser.getShortUserName() + \".hosts\") is null or MachineList.includes(remoteAddress) is false — e.g. the .hosts property lists specific IPs and the connection arrives from a different one (NAT, extra NIC, container network).","commonSituations":"Setting hadoop.proxyuser.<name>.groups but forgetting .hosts; Oozie or HiveServer2 on a host not listed; Kubernetes/Docker deployments where egress IP differs from the configured hostname; DNS entries that resolve differently from the connecting IP.","solutions":["Add or widen hadoop.proxyuser.<USER>.hosts in core-site.xml to include the connecting host's IP or FQDN (or \"*\" for testing)","Refresh the proxy config on the NameNode/ResourceManager (`-refreshSuperUserGroupsConfiguration`) after the change","Confirm the actual source IP of the denied connection from the message and add that exact address","Check that the key uses the real user's short name: hadoop.proxyuser.<shortname>.hosts"],"exampleFix":"<!-- before -->\n<property>\n  <name>hadoop.proxyuser.oozie.groups</name>\n  <value>*</value>\n</property>\n<!-- .hosts missing -> every impersonated call fails -->\n\n<!-- after -->\n<property>\n  <name>hadoop.proxyuser.oozie.groups</name>\n  <value>*</value>\n</property>\n<property>\n  <name>hadoop.proxyuser.oozie.hosts</name>\n  <value>10.0.0.5,10.0.0.6</value>\n</property>","handlingStrategy":"try-catch","validationCode":"String hostsKey = \"hadoop.proxyuser.\" + realUser.getShortUserName() + \".hosts\";\nString hosts = conf.get(hostsKey);\nif (hosts == null) {\n  LOG.warn(\"{} not set; all proxy connections from this super-user will be denied\", hostsKey);\n}","typeGuard":null,"tryCatchPattern":"try {\n  ProxyUsers.authorize(proxyUgi, remoteAddress);\n} catch (AuthorizationException e) {\n  if (e.getMessage().contains(\"Unauthorized connection for super-user\")) {\n    // host ACL problem: fix hadoop.proxyuser.<user>.hosts, no point retrying from same IP\n  }\n  throw e;\n}","preventionTips":["Always configure .hosts alongside .groups for proxyusers","In containerized setups, list egress IPs or use a hostname pattern covering the pods","Refresh proxy configuration on all NameNodes/ResourceManagers after edits"],"tags":["authorization","proxy-user","ip-allowlist","security","hadoop","core-site"],"backgroundTag":"ip-not-in-allowlist","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}